Date: Sun, 02 Oct 2016 22:06:15 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: NSPR 4.12, NSS 3.22.1 and PR_GetEnvSecure It seems this was never disclosed properly; there are still a couple of hidden Mozilla bugs about this. The NSS 3.22.1 announcement <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.22.1_release_notes> mentions one: bug 1194680: NSS has been changed to use the PR_GetEnvSecure function that was made available in NSPR 4.12 The story behind this is that NSS uses environment variables to configure lots of things, some of which refer to file system locations. Others can be degrade the operation of NSS in various ways, forcing compatibility modes and so on. Previously, these environment variables were not ignored SUID binaries. NSPR 4.12 and NSS 3.22.1 introduce a new API, PR_GetEnVSecure, to address this. It's a very thin wrapper around glibc's secure_getenv and similar functions on other systems. Both NSPR and NSS need to be upgraded to address this; even if you run s/PR_GetEnvSecure/secure_getenv/ on the NSS sources, some unprotected environment variable lookups remain in NSPR.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ